🎯 Exam at a Glance
| Attribute | Detail |
|---|---|
| Certification | GWAPT — GIAC Web Application Penetration Tester |
| Issuer | GIAC (Global Information Assurance Certification) |
| Training | SANS SEC542 — Web App Penetration Testing & Ethical Hacking |
| Questions | 82 |
| Duration | 3 hours |
| Passing Score | 71% |
| Format | CyberLive — live lab environment + traditional questions |
| Proctoring | ProctorU (remote) or Pearson VUE (onsite) |
| Validity | 4 years (renewable via CPEs) |
| DoD 8140 | Approved |
📌 GWAPT Exam Objectives
| # | Objective | This Page |
|---|---|---|
| ★ 1 | Web Application Overview | ✓ Covered |
| 2 | Reconnaissance and Mapping | — |
| 3 | Web Application Configuration Testing | — |
| 4 | Web Application Authentication Attacks | — |
| 5 | Web Application Session Management | — |
| 6 | Web Application SQL Injection Attacks | — |
| 7 | Cross-Site Request Forgery, XSS & Client Injection Attacks | — |
| ★ 8 | Web Application Testing Tools | ✓ Covered |
💡 Why This Page
"Before you can attack, you need to understand what you're attacking and how to wield your tools — Objectives 1 and 8 are the foundation of every other GWAPT topic."
- Objective 1 covers the HTTP/HTTPS protocol, web app architecture, JavaScript, AJAX, SOP, CORS, and cookie security — the baseline every subsequent objective builds on.
- Objective 8 covers Burp Suite, OWASP ZAP, fuzzing tools, browser DevTools, Nikto, Gobuster, FFuF, and the OWASP Testing Guide methodology.
- Together, these two objectives teach you both the target and the tools — critical before studying injections, session management, or auth attacks.
⚠️ CyberLive Format Notice: Unlike traditional multiple-choice exams, GWAPT uses live lab environments — hands-on tool proficiency matters as much as knowledge. You must be able to actually use Burp Suite, curl, and other tools in a real environment, not just recall their names.
Click any section to expand. All content maps to GWAPT Objectives 1 & 8.
🌐 HTTP Fundamentals (Objective 1)▾
Core Properties
- Stateless protocol: each request is independent — sessions maintained via cookies/tokens
- Request structure: Method + URI + HTTP version → headers (Host, User-Agent, Accept, Cookie, Authorization, Content-Type) → body (for POST/PUT)
- Response structure: Status line → headers (Set-Cookie, Content-Type, Location, X-Frame-Options, CSP) → body
HTTP Methods
- GET — retrieve resource; idempotent; no body
- POST — submit data; not idempotent; has body
- PUT — replace entire resource at URI
- PATCH — partial update of a resource
- DELETE — remove resource
- HEAD — headers only, no body (same as GET but no response body)
- OPTIONS — used in CORS preflight to query allowed methods
- TRACE — echoes request back to sender; often disabled; enables Cross-Site Tracing (XST)
HTTP Status Codes
- 1xx Informational — 100 Continue, 101 Switching Protocols
- 2xx Success — 200 OK, 201 Created, 204 No Content
- 3xx Redirect — 301 Permanent, 302 Temporary, 304 Not Modified
- 4xx Client Error — 400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 405 Method Not Allowed, 429 Rate Limited
- 5xx Server Error — 500 Internal, 502 Bad Gateway, 503 Service Unavailable
Pentest tip: 401 = no valid credentials sent; 403 = credentials may be fine but access denied. A 403 on /admin tells you the resource exists — 404 does not.
🔒 HTTPS & TLS (Objective 1)▾
TLS Handshake (simplified)
- ClientHello — client sends supported cipher suites & TLS versions
- ServerHello + Certificate — server selects cipher, sends cert
- Key Exchange — client verifies cert, derives session keys
- Finished — both sides confirm; encrypted tunnel established
Certificate & Trust
- Chain of trust: certificate signed by intermediate CA signed by root CA
- Validation checks: expiry, CN/SAN matching, CRL/OCSP revocation
- HSTS: HTTP Strict Transport Security — forces HTTPS on all future visits; prevents SSL stripping attacks
- Certificate pinning: app pins expected cert/public key — defeats MitM even with valid CA-signed cert; critical for Burp proxy setup (must add Burp CA)
TLS Versions
- SSLv2/SSLv3 — broken, deprecated
- TLS 1.0/1.1 — deprecated (vulnerable to POODLE, BEAST)
- TLS 1.2 — acceptable; widely deployed
- TLS 1.3 — current best; mandatory forward secrecy
Weak Cipher Suites (know for exam)
- RC4 — broken (biased keystream)
- DES/3DES — SWEET32 attack
- Export ciphers — FREAK attack
- Anonymous DH — no authentication; MitM trivial
Tool: testssl.sh automates TLS configuration assessment — checks versions, ciphers, certificate validity, HSTS, HPKP.
🏗️ Web Application Architecture (Objective 1)▾
Tiers & Patterns
- Three-tier: Presentation (browser) → Logic (app server) → Data (database)
- MVC: Model (data/business logic) · View (UI rendering) · Controller (request handling)
- Client-side: browser executes HTML/CSS/JavaScript; DOM = in-memory tree of the page
- Server-side: processes requests, queries DB, returns responses
API Styles
- REST: stateless, resource-based URLs (
/api/users/123), standard HTTP verbs, JSON responses - SOAP: XML-based, WSDL service description, heavy legacy enterprise
- GraphQL: single endpoint, client specifies data shape — security risks: introspection leaks schema, deep queries cause DoS, batching attacks
- Microservices: many services via APIs — expanded attack surface per service
⚡ JavaScript, AJAX, SOP & CORS (Objective 1)▾
- JavaScript: executes in browser context — DOM manipulation, event handling, async requests
- AJAX: XMLHttpRequest and
fetch()API — update page without full reload - JSON:
{"key": "value"}— JavaScript's native data format for API responses - Same-Origin Policy (SOP): browser restricts JS from reading responses from different origins. Origin = scheme + domain + port (all three must match)
- CORS: server explicitly allows cross-origin reads via
Access-Control-Allow-Originheader; OPTIONS preflight for non-simple requests - JSONP: legacy cross-origin workaround using
<script>tags — security risk if attacker-controlled endpoint
Cookie Security Flags
- HttpOnly — JavaScript (
document.cookie) cannot read the cookie; prevents XSS-based theft - Secure — cookie only sent over HTTPS connections
- SameSite=Strict — never sent on cross-site requests (strong CSRF protection)
- SameSite=Lax — sent on top-level navigations but not embedded requests
- SameSite=None — always sent cross-site; requires Secure flag
Input/Output Security
- Input validation: client-side = easily bypassed via proxy; server-side validation is authoritative
- Output encoding: escape special chars in correct context (HTML, JS, URL, CSS) to prevent injection
🕷️ Burp Suite — Primary Testing Tool (Objective 8)▾
Proxy
Intercepts browser ↔ server traffic. Configure browser: 127.0.0.1:8080. Install Burp CA cert in browser to intercept HTTPS.
Target
Site map of discovered content, scope definition. Define in-scope hosts to filter traffic.
Repeater
Manually modify and replay individual requests. Best tool for manual exploitation — tweak parameters, observe responses.
Decoder
Encode/decode Base64, URL, HTML, hex, gzip. Identify and manipulate obfuscated data in tokens and parameters.
Comparer
Diff two requests or responses. Find subtle differences — useful in blind injection and username enumeration.
Sequencer
Analyze randomness/entropy of session tokens. Low entropy = predictable tokens = session hijacking risk.
Scanner (Pro)
Automated vulnerability detection. Passive: analyzes existing traffic. Active: sends probes to targets.
Extender
BApp Store plugins — extend functionality (e.g., Active Scan++, JWT Editor, Param Miner).
Intruder Attack Types (must memorize)
- Sniper — one payload set, cycles through one position at a time; other positions stay static. Best for single-point fuzzing.
- Battering Ram — one payload set, inserts same value in all positions simultaneously. Useful when same payload needed everywhere.
- Pitchfork — multiple payload sets (one per position), iterated in parallel (paired rows). Use for username + password combos from a list.
- Cluster Bomb — multiple payload sets, all combinations (Cartesian product). Full brute force — use sparingly; generates huge request volume.
Match and Replace: auto-modify requests based on rules (e.g., always replace User-Agent, swap session token). Configured in Proxy → Options.
🔓 OWASP ZAP (Objective 8)▾
- Free, open-source alternative and complement to Burp Suite
- Automated scanner: spider (crawls links) + active scan (sends probes) — good for broad vulnerability discovery
- Forced Browse: wordlist-based discovery of hidden files/directories
- Fuzzer: similar to Burp Intruder — parameter-level fuzzing
- WebSocket support: test real-time web application traffic
- API integration: scriptable via REST API — integrate into CI/CD pipelines for automated security testing
💥 Fuzzing & Directory Tools (Objective 8)▾
- Wfuzz: command-line fuzzer —
wfuzz -c -z file,wordlist.txt http://target/FUZZ - FFuF (Fuzz Faster U Fool): fast directory/file/parameter fuzzer —
ffuf -w wordlist.txt -u http://target/FUZZ - Gobuster: directory & file enumeration —
gobuster dir -u http://target -w wordlist.txt - DirBuster: GUI-based directory brute-forcer (OWASP project)
- Common wordlists: SecLists (Daniel Miessler), dirbuster lists, rockyou.txt (passwords)
- Fuzzing targets: URL paths (directory brute force), GET/POST parameters, headers, cookie values
Additional Recon Tools
- Nikto: web server scanner — outdated software, dangerous files, misconfigurations
- curl: command-line HTTP requests — great for scripting and quick manual testing
- nmap:
nmap -sV -p 80,443,8080,8443 target— port scanning & service detection - Whatweb/Wappalyzer: technology fingerprinting — identifies CMS, frameworks, server software
- testssl.sh: TLS/SSL configuration testing — cipher suites, protocol versions, cert validity
🖥️ Browser Developer Tools (Objective 8)▾
- Network tab: inspect all HTTP requests/responses, headers, timing, WebSocket frames
- Console: JavaScript execution, error messages,
document.cookie,localStorageinspection - Storage: cookies, localStorage, sessionStorage, IndexedDB — inspect and modify client-side state
- Debugger: JavaScript breakpoints, source map analysis, deobfuscate minified code
- Elements: DOM inspection and modification — remove client-side validation controls
📋 OWASP Testing Guide Methodology (Objective 8)▾
- Phase 1: Information gathering — passive & active recon
- Phase 2: Configuration & deployment management testing
- Phase 3: Identity management testing
- Phase 4: Authentication testing
- Phase 5: Authorization testing
- Phase 6: Session management testing
- Phase 7: Input validation testing (SQLi, XSS, injection)
- Phase 8: Error handling
- Phase 9: Cryptography testing
- Phase 10: Business logic testing
- Phase 11: Client-side testing
Six memory hooks for high-density GWAPT topics. Read the acronym, say the phrase, close your eyes and recall.
HTTP Methods
GPDPPDHOT
G·P·D·P·P·D·H·O·T
"Get Posted Data, Put Patches, Delete Headers On Time"
GET · POST · DELETE · PUT · PATCH · DELETE · HEAD · OPTIONS · TRACE — covers all 8 HTTP verbs. Remember TRACE is last and often disabled for security (XST attacks).
HTTP Status Codes
I Saw Robbers Causing Suffering
1·2·3·4·5
"I Saw Robbers Causing Suffering"
1xx Info · 2xx Success · 3xx Redirect · 4xx Client fault · 5xx Server fault. Key distinctions: 401 = no auth sent, 403 = access denied (resource exists!), 404 = not found.
TLS Handshake
CHKF
C · H · K · F
"Can Hackers Keep Files?"
ClientHello → server Hello + Certificate → Key Exchange → Finished. Burp intercepts HTTPS by acting as a MitM — requires installing Burp's CA cert in the browser.
Burp Intruder
SBPC — Some Bad Pentesters Crash
S · B · P · C
"Some Bad Pentesters Crash"
Sniper (1 payload, 1 position) · Battering Ram (1 payload, all positions same) · Pitchfork (paired sets, parallel) · Cluster Bomb (all combos — brute force). Pitchfork = paired wordlists (user + pass lists).
Same-Origin Policy
SOP = Scheme + Domain + Port
Same Dad, Same Port
"Same Origin = Same Dad, Same Port"
All three must match: scheme (http vs https), domain (site.com vs api.site.com), port (80 vs 8080). One mismatch = different origin = SOP blocks JS reads. CORS headers allow selective exceptions.
Cookie Security Flags
HttpOnly · Secure · SameSite
3S: JS · Sniff · Strangers
"HTTP Stops JavaScript, Secure Stops Sniffing, SameSite Stops Strangers"
HttpOnly = no document.cookie access (blocks XSS theft) · Secure = HTTPS only (blocks sniffing) · SameSite=Strict = no cross-site sends (blocks CSRF). All three together = hardened cookie.
Question 1 of 10
Click any card to flip it and reveal the answer. Click again to flip back.
SOP
What is the Same-Origin Policy and what specific threat does it prevent?
Tap to reveal →
SOP: Browser security rule that prevents JavaScript from reading responses from a different origin (scheme + domain + port).
Prevents: a malicious site's JS from reading your bank's responses, stealing session data, or exfiltrating sensitive page content. CORS headers are the controlled exception.
Prevents: a malicious site's JS from reading your bank's responses, stealing session data, or exfiltrating sensitive page content. CORS headers are the controlled exception.
Tap to flip back
CORS
What is CORS and what is the key response header that enables it?
Tap to reveal →
CORS (Cross-Origin Resource Sharing): Server-side mechanism that explicitly permits cross-origin JS reads by adding headers to responses.
Key header:
Key header:
Access-Control-Allow-Origin: https://trusted.com. Preflight: browser sends OPTIONS request before non-simple cross-origin requests. Misconfigured CORS (wildcard + credentials) = data theft risk.Tap to flip back
Burp Intruder
Burp Intruder: Sniper vs. Cluster Bomb — when do you use each?
Tap to reveal →
Sniper: 1 payload set, 1 position at a time. Use for testing a single injection point with many payloads (e.g., SQLi list on one parameter).
Cluster Bomb: Multiple payload sets, every combination (Cartesian product). Use for full brute force across multiple positions (e.g., all usernames × all passwords). Generates massive request volume — use carefully.
Cluster Bomb: Multiple payload sets, every combination (Cartesian product). Use for full brute force across multiple positions (e.g., all usernames × all passwords). Generates massive request volume — use carefully.
Tap to flip back
Cookie Flags
HttpOnly vs. Secure vs. SameSite — what does each flag do?
Tap to reveal →
HttpOnly: Blocks JavaScript (
Secure: Cookie only transmitted over HTTPS. Prevents sniffing on plain HTTP.
SameSite=Strict: Cookie never sent on cross-site requests. Primary CSRF mitigation. Lax = top-level nav only. None = always cross-site (requires Secure).
document.cookie) from reading the cookie. Mitigates XSS-based session theft.Secure: Cookie only transmitted over HTTPS. Prevents sniffing on plain HTTP.
SameSite=Strict: Cookie never sent on cross-site requests. Primary CSRF mitigation. Lax = top-level nav only. None = always cross-site (requires Secure).
Tap to flip back
Exam Format
What is the GWAPT CyberLive format and how does it differ from traditional GIAC exams?
Tap to reveal →
CyberLive: GWAPT uses a live lab environment alongside traditional questions. You interact with real tools (Burp Suite, curl, nmap, etc.) in a browser-based VM.
Unlike traditional GIAC exams (multiple choice only), CyberLive tests hands-on proficiency — you must actually perform tasks, not just recall facts. 82 questions, 3 hours, 71% passing score.
Unlike traditional GIAC exams (multiple choice only), CyberLive tests hands-on proficiency — you must actually perform tasks, not just recall facts. 82 questions, 3 hours, 71% passing score.
Tap to flip back
HTTP Status
HTTP 401 vs. 403 — what is the critical difference for a penetration tester?
Tap to reveal →
401 Unauthorized: No valid authentication credentials were sent (or they were invalid). Server is saying "who are you?" — login required.
403 Forbidden: Authentication may be fine, but access is denied for this resource. Server is saying "I know who you are, but no." The resource exists — 403 on /admin confirms the path is valid. 404 would mean it doesn't exist.
403 Forbidden: Authentication may be fine, but access is denied for this resource. Server is saying "I know who you are, but no." The resource exists — 403 on /admin confirms the path is valid. 404 would mean it doesn't exist.
Tap to flip back
Burp Repeater
What is Burp Repeater and what is its primary use case during a pentest?
Tap to reveal →
Burp Repeater: Captures a single HTTP request, lets you manually modify any part (headers, parameters, body, method), then resend it and observe the response — as many times as needed.
Use cases: manually exploiting injection vulnerabilities, testing parameter tampering, verifying authentication bypass, fine-tuning payloads found by Intruder, testing API endpoints. The go-to tool for manual exploitation.
Use cases: manually exploiting injection vulnerabilities, testing parameter tampering, verifying authentication bypass, fine-tuning payloads found by Intruder, testing API endpoints. The go-to tool for manual exploitation.
Tap to flip back
TLS Pinning
What is TLS certificate pinning and why does it matter for web app pentesting?
Tap to reveal →
Certificate Pinning: An app hardcodes the expected certificate or public key fingerprint. Even if you install a custom CA cert (like Burp's), the app rejects any certificate that doesn't match the pinned value — defeating your MitM proxy.
Pentest implication: if a mobile app or API client uses pinning, you must bypass it (frida, custom builds, etc.) before Burp can intercept. Standard browser-based testing is usually unaffected.
Pentest implication: if a mobile app or API client uses pinning, you must bypass it (frida, custom builds, etc.) before Burp can intercept. Standard browser-based testing is usually unaffected.
Tap to flip back
📊 Readiness Self-Assessment
Rate your confidence in each category. Your readiness score updates automatically.
1. HTTP Protocol Fundamentals & Status Codes
2. HTTPS / TLS & Certificate Security
3. Burp Suite (Proxy, Intruder, Repeater, Scanner)
4. Web App Architecture (REST, AJAX, SOP, CORS)
5. Fuzzing Tools & Web Testing Methodology
0%
Select your confidence level for each category above.
GIAC GWAPT Official Page
Official certification details, exam objectives, and registration for the GIAC Web Application Penetration Tester credential.
Visit GIAC →
SANS SEC542 Course
Web App Penetration Testing & Ethical Hacking — the official associated SANS training for the GWAPT certification.
SANS SEC542 →
OWASP Testing Guide
The OWASP Web Security Testing Guide — the methodology reference for all 11 phases of web application testing.
OWASP WSTG →
PortSwigger Burp Suite Docs
Official Burp Suite documentation — Proxy, Intruder attack types, Repeater, Sequencer, and all modules explained.
Burp Docs →
OWASP ZAP
Free open-source web application security scanner. Download, documentation, and scripting guides for CI/CD integration.
ZAP Home →
SecLists Wordlists
Daniel Miessler's SecLists — the premier collection of wordlists for directory brute force, fuzzing, and password attacks.
GitHub →
Accelerate Your GWAPT Prep
FlashGenius gives you AI-powered flashcards, adaptive quizzes, and spaced repetition — built for GIAC certification success.
Start Free on FlashGenius